Cisco FMC Static-Credential Zero-Day Hits CISA's KEV Catalog With August 1 Federal Patch Deadline

Overview

Cisco has patched an actively exploited zero-day vulnerability in its Secure Firewall Management Center (FMC) software, and the Cybersecurity and Infrastructure Security Agency has added the flaw to its Known Exploited Vulnerabilities catalog, ordering federal civilian agencies to apply the fix by August 1, 2026, according to The Hacker News and Security Affairs.

The vulnerability, tracked as CVE-2026-20316, stems from static, hardcoded credentials for a low-privileged account built into the FMC web interface. Cisco’s security advisory states the flaw “could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.”

What We Know

• The flaw carries a CVSS base score of 5.3, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, according to NVD.
• Despite that base score, Cisco assigned the flaw its own Security Impact Rating of “High” rather than “Medium” because it “can be chained with other FMC flaws to escalate privileges,” according to SecurityWeek.
• Cisco said “if the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced,” according to SecurityWeek.
• Security researcher Jimi Sebree of Horizon3.ai is credited with discovering and reporting the flaw, according to The Hacker News.
• Cisco’s advisory states: “In July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability,” according to Cisco. The company has not disclosed when the attacks began, who is behind them, or how the vulnerability is being exploited, according to The Hacker News.
• Cisco has released hotfixes covering Secure FMC Software releases 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0, and “there are no workarounds that address this vulnerability,” according to Cisco’s advisory. The flaw does not affect Cloud-Delivered FMC, Firewall Device Manager, or other Cisco Secure Firewall products, according to BleepingComputer.
• Administrators can check for signs of compromise by searching system logs for references to “/var/tmp/license.tmp,” and Cisco recommends organizations that suspect exploitation contact its Technical Assistance Center and rotate all credentials, cryptographic keys, and certificates, according to Security Affairs.
• In the same advisory cycle, Cisco also updated guidance for a separate, more severe flaw, CVE-2026-20079, a critical authentication-bypass vulnerability with a CVSS score of 10.0, adding a new bug ID, “CSCwt95974,” the same indicators of compromise, and hotfixes, according to The Hacker News. That flaw was originally patched in March, according to SecurityWeek. Cisco said it is not aware of malicious exploitation of CVE-2026-20079, but The Hacker News noted that because the flaw enables execution of arbitrary script files to obtain root access, the shared indicator of compromise suggests attackers could potentially chain the two vulnerabilities together for code execution, according to The Hacker News.
• CISA added CVE-2026-20316 to its Known Exploited Vulnerabilities catalog under Binding Operational Directive 22-01, requiring federal civilian executive branch agencies to remediate the flaw by August 1, 2026, according to Security Affairs.

What We Don’t Know

• Cisco has not said when the attacks against CVE-2026-20316 began, who is responsible, or the specific technique used to exploit it, according to The Hacker News.
• Horizon3.ai, credited with the discovery, has not yet published its own technical write-up on the flaw, according to SecurityWeek.